Which versions of PHP are affected by CVE-2026-33517?

CVE-2026-33517 presents significant security risk, a cross-site scripting vulnerability rated CVSS 8.6.. A patch is available.

How to fix or mitigate CVE-2026-33517?

Within 7 days: Identify all affected systems and apply vendor patches promptly. Verify anti-CSRF tokens and content security policies are enforced.

PHP CVE-2026-33517

Q: What is the CVSS score of CVE-2026-33517?

CVE-2026-33517 has a CVSS 4.0 base score of 8.6 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.1%.

EUVD-2026-14523 HIGH

Cross-site Scripting (XSS) (CWE-79)

2026-03-23 GitHub_M

PHP XSS

8.6

CVSS 4.0 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

8.6 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

Scope

Lifecycle Timeline

Patch released

Mar 31, 2026 - 21:13 nvd

Patch available

EUVD ID Assigned

Mar 23, 2026 - 19:30 euvd

EUVD-2026-14523

Analysis Generated

Mar 23, 2026 - 19:30 vuln.today

CVE Published

Mar 23, 2026 - 19:13 nvd

HIGH 8.6

DescriptionGitHub Advisory

Mantis Bug Tracker (MantisBT) is an open source issue tracker. In version 2.28.0, when deleting a Tag (tag_delete.php), improper escaping of its name when displaying the confirmation message allows an attacker to inject HTML and, if CSP settings permit, achieve execution of arbitrary JavaScript. Version 2.28.1 fixes the issue. Workarounds include reverting commit d6890320752ecf37bd74d11fe14fe7dc12335be9 and/or manually editing language files to remove the sprintf placeholder %1$s from $s_tag_delete_message string.

AnalysisAI

MantisBT version 2.28.0 contains a Stored/Reflected Cross-Site Scripting (XSS) vulnerability in the tag deletion confirmation dialog (tag_delete.php) due to improper HTML escaping of tag names in the confirmation message. An authenticated attacker can inject malicious HTML and JavaScript code that executes in the browser of any user viewing the confirmation page, potentially leading to session hijacking, credential theft, or malware distribution. The vulnerability was patched in version 2.28.1, and proof-of-concept information is available via the GitHub security advisory and associated commit references.

Technical ContextAI

The vulnerability exists in PHP-based MantisBT issue tracking software (cpe:2.3:a:mantisbt:mantisbt) and stems from CWE-79 (Improper Neutralization of Input During Web Page Generation, aka Cross-site Scripting). The root cause is in tag_delete.php where user-supplied tag names are embedded into a confirmation message using sprintf with the placeholder %1$s without proper HTML entity encoding or sanitization. Commit d6890320752ecf37bd74d11fe14fe7dc12335be9 introduced this issue by adding the sprintf formatting without corresponding output escaping. When the confirmation page is rendered, an attacker's injected HTML tags (such as <script>, <img onerror>, or event handlers) are interpreted by the browser, potentially bypassing Content Security Policy (CSP) if misconfigured, allowing arbitrary JavaScript execution in the context of the MantisBT application.

RemediationAI

Immediately upgrade MantisBT to version 2.28.1 or later, which includes the security fix (referenced in commit 80990f43153167c73f11eb4b2bc7108d0c3d6b46). Until patching is feasible, apply the following interim mitigations: (1) revert commit d6890320752ecf37bd74d11fe14fe7dc12335be9 in your MantisBT installation, or (2) manually edit the language files to remove the sprintf placeholder %1$s from the $s_tag_delete_message string to prevent HTML injection in the confirmation message. Additionally, enforce a strict Content Security Policy (CSP) header on your MantisBT deployment to block inline script execution and restrict script sources to trusted domains only. Restrict tag deletion permissions to a minimal set of trusted administrators to reduce the attack surface. See https://github.com/mantisbt/mantisbt/commit/80990f43153167c73f11eb4b2bc7108d0c3d6b46 for technical details on the fix.